coulomb/audit-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare railiance01 delivery: dynamic leases, migrate Job, operator runbook
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
VaultDynamicSecret pulls database/creds/* so a rotating lease is not frozen
into KV. Runtime sets AUDIT_CORE_AUTO_MIGRATE=0; schema is a Job with the
migration lease. Image base is digest-pinned. Namespace and NetworkPolicies
are on the cluster; Deployment waits for the attended OpenBao ESO token.
This commit is contained in:
tegwick 2026-08-13 00:58:49 +02:00
parent bbf86b8373
commit 3a7d63e18f
18 changed files with 826 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

19
deploy/README.md Normal file
View file

@ -0,0 +1,19 @@
# railiance01 package
Target: railiance01 only. The workstation kubeconfig that talks to that API
is the `k3s-api-railiance01` tunnel (local port **16444**).
`~/.kube/config-hosteurope` currently points at 16443 (coulombcore); rewrite
the server port or export a copy before applying.
Apply order is documented in `docs/operator-runbook.md`. Do not apply the
Deployment until:
1. The image digest is pinned (not `REPLACE_AT_RELEASE`).
2. Secrets `audit-core-database`, `audit-core-database-migrate`, and
`audit-core-senders` exist.
3. Job `audit-core-migrate` has completed.
```bash
make image-build
make deploy-dry-run
```